buffer: accept negative indices in Buffer#slice()

A negative start or end parameter now indexes from the end of the
buffer. More in line with String#slice() and ArrayBuffer#slice().

TBD: Update Buffer#toString() as well?

Reviewers: @isaacs @trevnorris

See also #4742.